[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 1_ Overview:

There may be references in this publication to other publications currently under development by NIST in accordance  with  its  assigned  statutory  responsibilities.  The  information  in  this  publication,  including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where  they  exist,  remain  operative.  For  planning  and  transition  purposes,  federal  agencies  may  wish  to closely follow the development of new publications by NIST.

As a corollary to the assumption that an initial A&A was conducted consistent with SP 800-37 and related guidance, there is an assumption that the system(s) being assessed have the normal complement of security documentation, including the system security plan, the initial (or most current) security assessment report, and supporting documents such as the system contingency plan.

Awareness of the results to be produced facilitates better security engineering, by allowing security control designers to look at controls as parts of a system designed to achieve an overall purpose, allowing them to better control design and planning decisions.

Automation Support for Security Control Assessments_ Volume 1_ Overview


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations:

............................................................................... | Executive Summary.....................................................................................................
|
|------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|
| 1 Introduction ............................................................................................................1 | 1 Introduction ............................................................................................................1 | 1 Introduction ............................................................................................................1 |
| 1.1                                                                                | History of TLS................................................................................................. | 1                                                                                |
| 1.2                                                                                | Scope..............................................................................................................

Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Malware Incident Prevention and Handling for Desktops and Laptops provide? (Part 3)

[Assistant]
tions during public comment periods and provide feedback to NIST. All NIST Computer Security Division publications, other than the ones noted above, are available at http://csrc.nist.gov/publications.
## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Abstract

Malware, also known as malicious code, refers to a program that is covertly inserted into another program with the intent to destroy data, run destructive or intrusive programs, or otherwise compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system. Malware is the most common external threat to most hosts, causing widespread damage and disruption and necessitating extensive recovery efforts within most organizations. This publication provides recommendations for improving an organization's malware incident prevention measures.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.4 (NIST 3.3.4)?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

3.3.4. 3.3.4.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Derived PIV Application and Data Model Test Guidelines:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach  efforts  in  information  system  security,  and  its  collaborative  activities  with  industry, government, and academic organizations. The authors (David Cooper, Hildegard Ferraiolo and Ramaswamy Chandramouli of NIST; Nabil Ghadiali of the National Gallery of Art; and Jason Mohler and Steven Brady of Electrosoft Services, Inc.), wish to thank their colleagues who reviewed drafts of this document and contributed to its development.

Derived PIV Application and Data Model Test Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to NIST Cloud Computing Forensic Reference Architecture:

contributed significantly to researching this topic and to generating the data included in this publication, which constitutes the foundation of NIST's Cloud Computing Forensic Reference Architecture.
The authors thank Richard Lee of Citizens Financial Group, who served as a reviewer; Rodrigo Sardinas of Auburn University; Pw Carey of Grapevine Solutions; Richard Austin, formerly of HewlettPackard Enterprise; Dr. Ken Stavinoha, formerly with Cisco Systems; and Otto Scot Reemelin, who was with Ipro Tech during this work, for contributing to the data collection, analysis, and review. The authors would also like to thank Josiah Dykstra of the National Security Agency, Kenneth R. Zatyko of Buffalo Block Chain, and independent expert Keyun Ruan for their contributions during the early stages of this research. Finally, the authors wish to thank their peers who continuously provided feedback during the research and development stages of this document.

NIST Cloud Computing Forensic Reference Architecture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to SHA-3 Standard_ Permutation-Based Hash and Extendable-Output Functions:

| Key derivation function. |
| KECCAK             | The family of all sponge functions with a KECCAK- f permutation as the underlying function and multi-rate padding as the padding rule.
KECCAK was originally specified in [8]. |
| lane               | For a state array of a KECCAK- p permutation with width b , a sub-array of b /25 bits with constant x and y coordinates. |
| message            | A bit string of any length that is the input to a SHA-3 function. |
| multi-rate padding | The padding rule pad10*1, whose output is a 1 , followed by a (possibly empty) string of 0 s, followed by a 1 . |
| NIST               | National Institute of Standards and Technology. |
| plane              | For a state array of a KECCAK- p permutation with width b , a sub-array of b /5 bits with a constant y coordinate. |
| rate               | In the sponge construction, the number of input bits processed or output bits generated per invocation of the underlying function. |
| round              | The sequence of step mappings that is iterated in the calculation of a KECCAK- p permutation. |
| round constant     | For each round of a KECCAK- p permutation, a lane value that is determined by the round index. The round constant is the second input to the ι step mapping. |
| round index        | The value of the integer index for the rounds of a KECCAK- p permutation. |
| row                | For a state array, a sub-array of five bits with constant y and z coordinates. |
| SHA-3              | Secure Hash Algorithm-3. |
| SHAKE              | Secure Hash Algorithm KECCAK. |
| sheet              | For a state array of a KECCAK- p permutation with width b , a sub-array of b /5 bits with a constant x coordinate. |
| slice              | For a state array, a sub-array of 25 bits with a constant z coordinate. |

SHA-3 Standard_ Permutation-Based Hash and Extendable-Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

NTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................
32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................ 177
4.6   CONTINGENCY PLANNING ............................................................................................................ 215
4.7   IDENTIFICATION AND AUTHENTICATION .................................................................................... 243
4.8   INCIDENT RESPONSE ............................................................................................................... 275
4.9   MAINTENANCE ........................................................................................................................ 298
4.10   MEDIA PROTECTION .............................................................................................................. 316
4.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .......................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

The resulting tailored baseline set of security controls and the supporting rationale for the selection decisions (including any information system use restrictions required by organizations) are documented in system security plans. Documenting significant risk management decisions in the security control selection process is imperative so that authorizing officials have access to necessary information to make informed authorization decisions for organizational information systems, as demonstrated in Figure 3.

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Non-Fungible Token Security:

If the smart contract contains coding errors, there may be a vulnerability that enables an attacker to steal tokens. An evaluation of possible vulnerabilities in NFT contracts is available from [30]. The attacker would then likely sell the tokens quickly to obtain cryptocurrency because after launching the attack, their approach would be publicly visible on the blockchain. Others could then launch the same attack, or the contract manager could use the same vulnerability to restore tokens to their owners. If the contract manager can regain control of the smart contract, tokens could be restored. However, the attacker would still have the funds obtained through illegal token sales and the sold tokens would each have two owners (the original owners to whom the tokens are restored and the subsequent purchasers that unwittingly bought the stolen tokens).

An NFT is expected to have the property of being unchanging or immutable. NFT smart contracts enforce this in their code. However, a vulnerability in the smart contract could enable a malicious entity to change NFT data records.

20. If the smart contract code contains a vulnerability, the data records could be changed by a malicious actor.
21. Blockchains are occasionally changed through participant consensus or have their chains split into distinct and different versions when consensus is not reached on resolving a major issue.
22. A blockchain split will result in the duplication of NFT contracts, which in turn results in NFT owners having the same NFTs on two blockchains. They could sell one and keep the other, causing significant issues for NFTs that convey ownership rights over their linked asset.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Incident Response?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Guide to Secure Web Services:

3.2.2                                                                                | Laws of Identity... 3.2.2 Laws of Identity

In May 2005, Kim Cameron, Identity and Access Architect at Microsoft, authored The Laws of Identity 30 based on his research into the requirements for a unified identity metasystem , a system of identity systems that exposes a unified interface for disparate underlying identity technologies. 3.2.2 WS-Federation and WS-Trust

WS-Federation and WS-Trust were developed by IBM, Microsoft, RSA, Verisign, BEA, and several other vendors to create an identity federation system based on extensions to WS-Security that uses the core Web services protocols: SOAP and WSDL.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to A Roadmap for Successful Regional Alliances and Multistakeholder Partnerships to Build the Cybersecurity Workforce:

Patty Buddelmeyer Southwestern Ohio Council for Higher Education Dayton, OH

In  September  2016,  the  National  Initiative  for  Cybersecurity  Education,  led  by  the  National Institute of Standards and Technology in the U.S. Department of Commerce, awarded funding for five  pilot  programs  for  Regional  Alliances  and  Multistakeholder  Partnerships  to  Stimulate (RAMPS)  Cybersecurity  Education  and  Workforce  Development.  The  document  that  follows provides  a  summary  of  the  five  pilot  programs  and  outlines  a  roadmap  for  building  similar programs based on the best practices found and lessons learned.

alliance; collaboration; cybersecurity; education; partnership; RAMPS; stakeholder; workforce.

A Roadmap for Successful Regional Alliances and Multistakeholder Partnerships to Build the Cybersecurity Workforce


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992:

- Establish security responsibility (e.g. security officers) (Priority A).
- -Develop and maintain site security policy and procedures, including a policy for handling security incidents.
- Support comprehensive security education programs for users.
- -Establish Forum of Incident Response Security Teams (FIRST) point of contacts.

We have security policy that we are willing to share with others; it has already been shared it with NCSA. We have an incident response team (such that it is) of about three people. We maintain a contact in the local FBI office so they will not be taken by surprise if we call them for help on a computer security problem.

STEINAUER; The Forum of Incident Response Security Teams (FIRST) is a cooperative effort involving a number of organizations. The concept of FIRST arose as the result of the 'Internet Worm' incident, along with a number of things that were going on in that period of time. It was clear that the basic nature of security threats had substantially changed and there were new requirements.

Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Computer Security Division 2007 Annual Report:

), and security planning. Together, these tenets will revolutionize healthcare, making it more consumercentric, and will improve both the quality and the efficiency of healthcare in the United States.
One of the critical components of these tenets is the assurance of privacy of health-related information as well as assuring the confidentiality and integrity of all health information technology (HealthIT) data  and  maintaining  the  availability  to  HealthIT  whenever  it  is  needed. CSD is intricately involved in assisting healthcare providers in this effort.

Computer Security Division 2007 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Attribute Considerations for Access Control Systems:

............................................................................. | Introduction............................................................................................................
| 1    |
|    | 1.1 Purpose.....................................................................................................................................1  | 1.1 Purpose.....................................................................................................................................1  |      |
|    | 1.2 Scope........................................................................................................................................2 | 1.2 Scope........................................................................................................................................2 |      |
|    | 1.3 Audience ...................................................................................................................................2  | 1.3 Audience ...................................................................................................................................2  |      |
|    | 1.4 Document Structure ..................................................................................................................2         | 1.4 Document Structure ..................................................................................................................2         |      |
| 2  | Consideration Elements........................................................................................ | Consideration Elements........................................................................................ | 4    |
| 3  | Attribute Considerations....................................................................................... | Attribute Considerations.......................................................................................

Attribute Considerations for Access Control Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines on Active Content and Mobile Code provide? (Part 2)

[Assistant]
is Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations.
National Institute of Standards and Technology Special Publication 800-28 Version 2 Natl. Inst. Stand. Technol. Spec. Publ. 800-28v2, 62 pages (Mar. 2008)

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. ## Acknowledgements

The authors, Wayne A. Jansen and Karen Scarfone of the National Institute of Standards and Technology (NIST) and Theodore Winograd of Booz Allen Hamilton, wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content, particularly Tim Grance and Anoop Singhal of NIST, Edward Tracy of Booz Allen Hamilton, and Kurt Dillard.

Guidelines on Active Content and Mobile Code


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Communications Protection?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Minimum Security Requirements for Multi-User Operating Systems:

| 1.4          | Terminology                                                 | 1-7    |
|           | 1.5          | Document Organization                                       | 1-7    |
| 2.
| Rationale    | Rationale                                                   | 2-1    |
|           | 2.1          | Intended Method of Use                                      | 2-1    |
|           | 2.2          | Environmental Assumptions                                   | 2-1    |
|           | 2.3          | Expected Threats                                            | 2-2    |
|           | 2.4          | Security Features and Assurances                            | 2-2    |
|           |              | 2.4.1 Identification and Authentication                     | 2-3    |
|           | 2.4.2        | Access Control                                              | 2-3    |
|           | 2.4.3        | Audit                                                       | 2-3    |
|           | 2.4.4        | System Integrity                                            | 2-4    |
|           | 2.4.5        | Data Integrity                                              | 2-4    |
|           | 2.4.6        | Reliability of Service                                      | 2-4    |
|           | 2.4.7        | Product Development Assurance                               | 2-4    |
|           | 2.4.8        | Product Documentation Assurance                             | 2-5    |

Minimum Security Requirements for Multi-User Operating Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective:

System Security Engineering standards describe planning and design activities to meet security specifications or requirements for the purpose of reducing system susceptibility to threats, increasing system resilience, and enforcing organizational security policy. A comprehensive system security engineering effort: includes a combination of technical and nontechnical activities; ensures all relevant stakeholders are included in security requirements definition activities; ensures that security requirements are planned, designed, and implemented into a system during all phases of its lifecycle; assesses and understands susceptibility to threats in the projected or actual environment of operation; identifies and assesses vulnerabilities in the system and its environment of operation; identifies, specifies, designs, and develops protective measures to address system vulnerabilities; evaluates/assesses protective measures to ascertain their suitability, effectiveness and degree to which they can be expected to reduce mission/business risk; provides assurance evidence to substantiate the trustworthiness of protective measures; identifies quantifies, and evaluates the costs and benefits of protective measures to inform engineering trade-off and risk response decisions; and leverages multiple security focus areas to ensure that protective measures are appropriate, effective in combination, and interact properly with other system capabilities. Emergency Management First responders use private, land mobile radio systems for their mission critical voice communications. These networks are designed and built on a set of standards and user requirements that address critical operational concerns, including user authentication, security and reliability. With emergence of broadband applications and services, first responders are beginning to incorporate broadband data applications into their day-to-day operations.

Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Workshop Summary Report for “Building on the NIST Foundations_ Next Steps in IoT Cybersecurity” provide? (Part 5)

[Assistant]
.................................16                    |
|                                                                                | B.
List of Symbols, Abbreviations, and                                                                                |                                                                                |
| Appendix                                                                                | Acronyms...........................................20                                                                                |                                                                                |
| List of Tables                                                                                | List of Tables                                                                                | List of Tables                                                                                |
| Table 1. Workshop Agenda..........................................................................................................2      | Table 1. Workshop Agenda..........................................................................................................2      | Table 1. Workshop Agenda..........................................................................................................2      |

## Introduction

On June 22, 2022, the National Institute of Standards and Technology (NIST) conducted a virtual workshop entitled Building on the NIST Foundations: Next Steps in IoT Cybersecurity .

Workshop Summary Report for “Building on the NIST Foundations_ Next Steps in IoT Cybersecurity”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to An Introduction to Information Security:

|                                                                                | 6.3 Implement ....................................................................................................... 37                  |
|--------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|
| 6.4 Assess ............................................................................................................ | 37                                                                                |
| 6.5 Authorize......................................................................................................... | 37                                                                                |
| 6.6 Monitor............................................................................................................ | 37                                                                                |
| 7 Assurance.............................................................................................................38           |                                                                                |
| 7.1 Authorization ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook:

to comply with applicable provisions of NMI 2410.7 and this Handbook. - (6) Review and concur on exceptions from implementing specific requirements of this Handbook. - e. Other Headquarters Offices .
Other HQ offices that play an integral role include the:
- (1) Inspector General, which has independent audit and criminal investigation responsibilities. - (2) NASA Security Office, which has traditional security responsibilities in the areas of personnel security, physical security, and national (including defense-related) security documents and operations control. - (3) Office of Space Operations, which has agencywide responsibilities for telecommunications security. - (4) Office of Procurement, which has responsibilities for ensuring that appropriate functional security requirements are included in acquisitions for automated information products and services. - (5) Management Operations Office, which has responsibilities for the NASA Internal Controls Program
- (6) Office of Safety, Reliability, Maintainability, and Quality Assurance, which has responsibilities related to automated information resources supporting manned space flight.

National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guidelines for Evaluating Differential Privacy Guarantees:

## Toward Standardization, Certification, and Evaluation

The pyramid and accompanying evaluation processes are not designed for setting the parameters of a differential privacy guarantee, though they can support it. Planning a differentially private data release or designing a differentially private system requires eliciting requirements from various stakeholders-for privacy, utility, usability, trust models, and more-then setting the parameters of the differential privacy guarantee to meet these requirements. Since differential privacy involves tradeoffs between the elements of the guarantee, it is often impossible to meet all of the requirements simultaneously, so arriving at a final design requires iterative negotiation involving all of the stakeholders.

The most precise approaches for interpreting and comparing differential privacy guarantees are based on hypothesis testing [23, 24] or interpretation via Bayesian or frequentist semantics [14]. These approaches allow direct, precise interpretation of the privacy guarantee. For example, the formal definition of pure ε -differential privacy (Definition 1) can be viewed as bounding the error rates in a hypothesis test over the output of a differentially private mechanism:

Guidelines for Evaluating Differential Privacy Guarantees


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

'We have one annual course, and we've bundled a lot of training requirements in this one course. It's security awareness, privacy, incident response, rules of behavior, all these things in one course.' (S06)

'Logistics and event planning are key KSA [knowledge, skills, and abilities] areas.' (Q56)

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guide to General Server Security:

| Introduction | ......................................................................................................................1-1 | | | | 1.1 | Authority...................................................................................................................1-1 | | | | 1.2 | Purpose and Scope .................................................................................................1-1 | | | | 1.3 | Audience..................................................................................................................1-2 | | | | 1.4 | Document Structure.................................................................................................1-2 | | | 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Personnel Security?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

| Table 1. Security Requirement Families .......................................................................................................4          |
|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2. Security Control Tailoring Criteria.................................................................................................93          |
| Table 3. Access Control (AC) .......................................................................................................................93   |
| Table 4. Awareness and Training (AT).........................................................................................................94          |
| Table 5. Audit and Accountability (AU).......................................................................................................95          |
| Table 6. Assessment, Authorization, and Monitoring (CA).........................................................................95                       |
| Table 7. Configuration Management (CM).................................................................................................96                |
| Table 8. Contingency Planning (CP) ............................................................................................................96        |
| Table 9. Identification and Authentication (IA) ..........................................................................................97             |
| Table 10. Incident Response (IR).................................................................................................................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guidelines on Firewalls and Firewall Policy:

| Executive Summary..............................................................................................................ES-1   | Executive Summary..............................................................................................................ES-1    | Executive Summary..............................................................................................................ES-1    | Executive Summary..............................................................................................................ES-1    |
|---------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
| 1.

Guidelines on Firewalls and Firewall Policy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Guide to Operational Technology (OT) Security:

4.2.1.  Supply Chain Risk Management .............................................................................54

6.1.5.  Supply Chain Risk Management (ID.SC) .................................................................95

D.2.14.  NIST Supply Chain Traceability for Agri-Food Manufacturing ............................ 200

Guide to Operational Technology (OT) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guidelines for Media Sanitization:

ontaining sensitive data that leave an organization without effective sanitization expose a significant vulnerability to 'dumpster divers' and overcurious employees. - Information storage media (ISM).
ISM commonly 2 takes the form of:
- o Devices that contain bits and bytes, such as hard disk drives (HDDs), solid state drives (SSDs), random access memory (RAM), read-only memory (ROM), optical disks, magnetic tape, flash memory, memory devices, phones, mobile computing devices, networking devices, and office equipment
- o Systems that provide 'virtual' or 'logical' storage that abstracts the underlying electronic media (e.g., cloud storage, object storage)

Some types of ISM can contain more physical storage than the user addressable capacity (e.g., overprovisioning) for endurance and performance purposes. For example, an ISM can have 1024 GB of total physical capacity but only 900 GB of available capacity (i.e., user accessible storage). If the ISM implements data reduction techniques (e.g., data compression) internally, it is also possible for the user-addressable capacity to exceed the total physical capacity. In either case, user data may be stored on the full 1024 GB because of the mechanisms in the ISM, and the entire contents should be sanitized.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 1?

[Assistant]
According to A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data:

## NISTIR 8221

## A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data

Ramaswamy Chandramouli Anoop Singhal Duminda Wijesekera Changwei Liu

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8221

<!-- image -->

## NISTIR 8221

## A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data

Ramaswamy Chandramouli Anoop Singhal Duminda Wijesekera Computer Security Division Information Technology Laboratory

Changwei Liu George Mason University Fairfax, VA

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8221

June 2019

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

## National Institute of Standards and Technology Interagency or Internal Report 8221 35 pages (June 2019)

## This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8221

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI:

3.1.1
APTL: 100342

Mindcraft, Inc. 3.1.1
APTL: 100342

Mindcraft, Inc.

Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations. All  information  systems  process,  store,  or  transmit  some  type  of  information. For  example, information about the temperature in a remote facility collected and transmitted by a sensor to a monitoring station, location coordinates transmitted by radio to a controller on a weapons system, photographic images transmitted by a remote camera (land/satellite-based) to a server, or health IT devices transmitting patient information via a hospital network, require protection. This information can be protected by: categorizing the information to determine the impact of loss; assessing whether the processing of the information could impact individuals' privacy; and selecting and implementing controls that are applicable to the IT resources in use. Therefore, cloud-based  systems,  industrial/process  control  systems,  weapons  systems,  cyber-physical systems, applications, IoT devices, or mobile devices/systems, do not require a separate risk management process but rather a tailored set of controls and specific implementation details determined by applying the existing RMF process.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Workshop Summary Report for “Building the Federal Profile For IoT Device Cybersecurity” Virtual Workshop provide?

[Assistant]
## NISTIR 8322

## Workshop Summary Report for 'Building the Federal Profile for IoT Device Cybersecurity' Virtual Workshop

Katerina N. Megas Michael Fagan David Lemire

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8322

<!-- image -->

## NISTIR 8322

## Workshop Summary Report for 'Building the Federal Profile for IoT Device Cybersecurity' Virtual Workshop

Katerina N. Megas Michael Fagan Applied Cybersecurity Division Information Technology Laboratory

David Lemire Huntington Ingalls Industries Annapolis Junction, MD

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8322

January 2021

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8322 30 pages (January 2021)

## This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8322

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.

Workshop Summary Report for “Building the Federal Profile For IoT Device Cybersecurity” Virtual Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation:

th  industry, government, and academic organizations. | [RouteLeak1]   | K. Sriram (Ed.) and A. Azimov (Ed.), 'Methods for Detection and Mitigation of BGP Route Leaks', IETF Internet Draft, July 2019.
https://datatracker.ietf.org/doc/draft-ietf-grow-route-leak-detection- mitigation/                                                                                |
|----------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [RouteLeak2]   | A. Azimov, E. Bogomazov, R. Bush, K. Patel, and K. Sriram, "Route Leak Prevention using Roles in Update and Open Messages", IETF Internet Draft, July 2019. https://datatracker.ietf.org/doc/draft-ietf-idr- bgp-open-policy/                                                                                |
| [RouteLeak3]   | K. Sriram (Ed.), 'Design Discussion of Route Leaks Solution Methods', IETF Internet Draft, August 2019. https://datatracker.ietf.org/doc/draft- sriram-idr-route-leak-solution-discussion/                                                                                |
| [Routinator]   | Routinator: NLNetLabs' RPKI validator. https://nlnetlabs.nl/projects/rpki/routinator/                                                                                |
| [Rsync]        | Wiki page on the Rsync protocol.

Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Minimum Security Requirements for Multi-User Operating Systems:

| 1.4          | Terminology                                                 | 1-7    |
|           | 1.5          | Document Organization                                       | 1-7    |
| 2.
| Rationale    | Rationale                                                   | 2-1    |
|           | 2.1          | Intended Method of Use                                      | 2-1    |
|           | 2.2          | Environmental Assumptions                                   | 2-1    |
|           | 2.3          | Expected Threats                                            | 2-2    |
|           | 2.4          | Security Features and Assurances                            | 2-2    |
|           |              | 2.4.1 Identification and Authentication                     | 2-3    |
|           | 2.4.2        | Access Control                                              | 2-3    |
|           | 2.4.3        | Audit                                                       | 2-3    |
|           | 2.4.4        | System Integrity                                            | 2-4    |
|           | 2.4.5        | Data Integrity                                              | 2-4    |
|           | 2.4.6        | Reliability of Service                                      | 2-4    |
|           | 2.4.7        | Product Development Assurance                               | 2-4    |
|           | 2.4.8        | Product Documentation Assurance                             | 2-5    |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Assessing Federal and Commercial Information Security Needs:

Manager, Computer Security Planning

Assessing Federal and Commercial Information Security Needs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Recommendation for Applications Using Approved Hash Algorithms:

The author, Quynh Dang of the National Institute of Standards and Technology (NIST) gratefully appreciates the contributions and comments from Elaine Barker, William E. Burr, Shu-jen Chang, Lily Chen, Donna F. Dodson, Morris Dworkin, John Kelsey, Ray Perlner, W. Timothy Polk and Andrew Regenscheid. The author also appreciates comments from Daniel Brown, Hugo Krawczyk, Praveen Gauravaram and Richard Davis during the development of this Recommendation.

Recommendation for Applications Using Approved Hash Algorithms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.4 (NIST 3.4.4)?

[Assistant]
According to Guidelines for Evaluating Differential Privacy Guarantees:

3.4.4. 3.4.4.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i:

| Executive Summary..............................................................................................................ES-1 | Executive Summary..............................................................................................................ES-1 | Executive Summary..............................................................................................................ES-1 | Executive Summary..............................................................................................................ES-1 | |---------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------| | | Introduction | ......................................................................................................................1-1 | | | | 1.1 | Authority...................................................................................................................1-1 | | | | 1.2 | Purpose and Scope | | | | 1.3 | .................................................................................................1-1 Audience..................................................................................................................1-1 | | | | 1.4 | Document Structure.................................................................................................1-1 | | | | 1.5 | How to Navigate This Document .............................................................................1-2 | | | | Overview of Wireless Networking | ..................................................................................2-1 | | | | 2.1 | History of Wireless Networking Standards...............................................................2-1 | | | | | 2.1.1 IEEE 802.11 Standards................................................................................2-1 | | | | | 2.1.2 Wi-Fi Alliance Certification............................................................................2-2 | | | | | 2.1.3 Other Wireless Standards | ............................................................................2-3 | | | 2.2 | IEEE 802.11 Network Components and Architectural Models.................................2-4 | | | | | 2.2.1 Ad Hoc Mode................................................................................................2-4 | | | | | 2.2.2 Infrastructure Mode ......................................................................................2-6 | | | | 2.3 | Summary..................................................................................................................2-6 | | | | Overview | of IEEE 802.11 Security ..................................................................................3-1 | | | | 3.1 | WLAN Security Concerns ........................................................................................3-1 | | | | 3.2 | History of Pre-RSN IEEE 802.11 Security ...............................................................3-2 | | | | | 3.2.1 Access Control and Authentication...............................................................3-2 | | | | | 3.2.2

Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance:

accreditation; assurances; authentication; authorization; availability; backup; certification; compromise; confidentiality; cryptanalysis; cryptographic key; cryptographic module; digital signature; key management; key management policy; key recovery; private key; public key; public key infrastructure; security plan; trust anchor; validation. 1. Government systems shall be configured so that approved algorithms (e.g., AES) shall be used [RFC 3962], and DES shall not be used [RFC 6649]. 2. An approved MAC checksum (e.g., HMAC-SHA1 or HMAC-SHA256-128) shall be installed and used in all implementations for data integrity purposes (see [RFC 3962] and the IETF Informational Draft, AES Encryption with HMAC-SHA2 for Kerberos 5 , at: http://tools.ietf.org/html/draft-ietf-kitten-aes-cts-hmac-sha2-04). 3. The AS, TGS, TSs, and clients shall use strong access control mechanisms 30 (physical and logical) for protecting and updating keys. 4. Kerberos version 5 permits the use of smart cards or tokens (e.g., FIPS 201 Personal Identity Verification cards [FIPS 201]) to store a user's password. Passwords stored on tokens shall be randomly generated; therefore, when tokens are used, a means of generating random passwords by a NIST-approved random number generation function ([SP 800-90A], [SP 800-90B], [SP 80090C]), and securely writing them on the token shall be used. When tokens are used, manual entry of passwords shall not be permitted except to authenticate the user to the token. 5. Kerberos with public key-based user authentication and key establishment can provide stronger security than password-based keys and should be installed where PKI mechanisms are available and the software has the capability. See [RFC 4556] for further information. 6. TLS should be used when the system supports it, see Section 4 for guidelines on using TLS. 7. If user passwords are generated by the system, the system shall generate strong passwords [SP 800-118].

Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation:

authentication; FIPS 201; identity credential; logical access control; on-card biometric comparison; Personal Identity Verification (PIV); physical access control; smart cards; secure messaging. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. Homeland Security Presidential Directive-12 (HSPD-12) called for the adoption of a common identification standard to govern the interoperable use of identity credentials to allow physical and logical access to federally controlled facilities and information systems. In response, Federal Information Processing Standard (FIPS) 201 [FIPS201], Personal Identity Verification (PIV) of Federal Employees and Contractors , was developed to define reliable, government-wide identity credentials for use in applications such as access to federally controlled facilities and information systems. FIPS 201 supports multiple types of authenticators, including authenticators on smart cards (also known as PIV Cards) and derived PIV credential authenticators in various other form factors. This publication contains technical specifications to interface with PIV Cards to retrieve and use identity credentials.

Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Computer Security Division 2003 Annual Report:

System security  accreditation is the  official management decision to authorize operation of an information system. This authorization, given by  a  senior  agency  official, is  applicable  to  a particular environment of operation, and explicitly  accepts  the  risk  to  agency  operations (including mission, functions, image, or reputation), agency  assets, or  individuals, remaining after the implementation of an agreed upon set of security controls. By accrediting an information  system, the  agency  official  is  not  only responsible for the security of the system but is also  accountable  for  adverse  impacts  to  the agency  if  a  breach  of  security  occurs. Security accreditation, which  is  required  under  OMB Circular  A-130, provides  a  form  of  quality control and challenges managers and technical staff at all levels to implement the most effective  security  controls  and  techniques, given technical  constraints, operational  constraints, cost  and  schedule  constraints, and  mission requirements. In  addition  to  risk  assessments  and  security plans, security  evaluation  also  plays  an  important role in the security accreditation process. It is essential that agency officials have the most complete, accurate, and trustworthy information possible on the security status of their information  systems  in  order  to  make  credible, riskbased decisions on whether to authorize operation  of  those  systems. This  information  and supporting evidence for system authorization is often  developed  during  a  detailed  security review  of  the  information  system, typically referred  to  as security certification. Security certification is the comprehensive evaluation of the  management, operational, and  technical security controls in an information system.

Computer Security Division 2003 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does The NIST Cybersecurity Framework (CSF) 2.0 provide? (Part 2)

[Assistant]
to build and host additional resources to help organizations implement the CSF, including Quick Start Guides and Community Profiles. All resources are made publicly available on the NIST CSF website.
Suggestions for additional resources to reference on the NIST CSF website can always be shared with NIST at cyberframework@nist.gov. ## Note to Readers

Unless otherwise noted, documents cited, referenced, or excerpted in this publication are not wholly incorporated into this publication. Before version 2.0, the Cybersecurity Framework was called the 'Framework for Improving Critical Infrastructure Cybersecurity.' This title is not used for CSF 2.0. ## Acknowledgments

The CSF is the result of a multi-year collaborative effort across industry, academia, and government in the United States and around the world. NIST acknowledges and thanks all of those who have contributed to this revised CSF. Information on the CSF development process can be found on the NIST CSF website. Lessons learned about the use of the CSF can always be shared with NIST at cyberframework@nist.gov. | Table of Contents                                                                                |
|---------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Cybersecurity Framework (CSF) Overview.......................................................................................1                 |
| 2. Introduction to the CSF Core...........................................................................................................3       |
| 3. Introduction to CSF Profiles and Tiers .............................................................................................6          |
| 4. Introduction to Online Resources That Supplement the CSF ............................................................9                         |
| 5.

The NIST Cybersecurity Framework (CSF) 2.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Computer Security Division 2006 Annual Report:

on and information systems using a standardized, risk-based  approach -  Developed  FIPS  200, Minimum  Security Requirements  for  Federal  Information  and  Information  Systems (issued March 2006).
- Define minimum information security requirements (management, operational, and technical security controls) for information and information systems in each such category - Developed SP 800-53, Recommended  Security  Controls  for  Federal  Information  Systems (revision 1 issued December 2006). - Identify methods for assessing effectiveness of security requirements - SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems (second public draft issued April 2006). - B ring the security planning process up to date with key standards and guidelines developed by NIST - SP 800-18 Revision 1, Guide for Developing Security  Plans  for  Federal  Information  Systems (issued February 2006). - Provide  assistance  to  Agencies  and  private  sector -  Conduct ongoing,  substantial  reimbursable  and  non-reimbursable  assistance support, including many outreach efforts such as the Federal Information Systems Security Educators' Association (FISSEA), the Federal Computer Security  Program Managers' Forum (FCSM Forum), the Small Business Corner, and the Program Review for Information Security Management Assistance (PRISMA). - Evaluate  security  policies  and  technologies  from  the  private sector and national security systems for potential Federal agency use -  Host  a  growing  repository  of  Federal  agency  security  practices, public/private  security  practices,  and  security  configuration  checklists for  IT  products. In  conjunction  with  the  Government  of  Canada's Communications  Security  Establishment,  CSD  leads  the  Cryptographic Module Validation Program (CMVP). The Common Criteria Evaluation and Validation Scheme (CCEVS) and CMVP facilitate security testing of IT products usable by the Federal government.

Computer Security Division 2006 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

SP 800-53 Revision 4 has been updated to reflect the evolving technology and threat space. Example areas include issues particular to mobile and cloud computing; insider threats; applications security; supply chain risks; advanced persistent threat; and trustworthiness, assurance, and resilience of information systems. The revision also contains a new appendix of privacy controls, and related implementation guidance (Appendix J), based on the Fair Information Practice Principles (FIPPs), a widely accepted framework of defining principles to be used in the evaluation and consideration of systems, processes, or programs that affect individual privacy. Many organizations use well-known international information security standards as the basis or as a supplemental source of security controls for risk management. To aid in selection and comparison, SP 800-53 Rev. 4 provides mapping tables to provide organizations with a general indication of security control coverage with respect to ISO/IEC 27001, Information technologySecurity techniques-Information security management systems-Requirements and ISO/IEC 15408, Information technology -- Security techniques -- Evaluation criteria for IT security . ISO/IEC 27001 applies to all types of organizations and specifies requirements for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving a documented information security management system (ISMS) within the context of business risks. ISO/IEC 15408 (also known as the Common Criteria) provides functionality and assurance requirements for developers of information systems and information system components (i.e., information technology products).

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Introduction to Cybersecurity for Commercial Satellite Operations:

| Functions   | Subcategories                                                                                | Informative                          | Reference                                                                                |
|-------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------|------------------------------------------------------------------------------------------------|
|             |                                                                                | SP 800-53, Rev. 4                    | SP 800-53, Rev. 5                                                                              |
|             | PR.PT-4: Communications and control networks are protected. | SC-32, AC-4, AC-17, SC-7             | AC-12, AC-17, CP-8, SC-5, SC-7, SC-10, SC-20, SC-21, SC-22, SC-23, SC-31, SC- 37, SC-38, SC-47 |
|             | PR.PT-5: Mechanisms (e.g., fail- safe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations. | PL-8, SC-6                           | PE-11, PL-8, SC-6                                                                              |
| Detect      | DE.AE-3: Event data are collected and correlated from multiple sources and sensors. | AU-6, CA-7, IR- 4, IR-5, IR-8, SI- 4 | AU-6, CA-7, IR-4, IR-5, IR-8, SI-4                                                             |
|             | DE.CM-1: The network is monitored to detect potential cybersecurity events. | SC-5                                 | AU-12, CA-7, CM-3, SC-5, SC-7, SI-4                                                            |
|             | DE.CM-4: Malicious code is detected.

Introduction to Cybersecurity for Commercial Satellite Operations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Security Analysis of First Responder Mobile and Wearable Devices:

| 6.3                                                                                | Structural and environmental incidents......................................................... | 26                                                                                |
|---------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------|
| 7 Threat Analysis ....................................................................................................28  | 7 Threat Analysis ....................................................................................................28  |                                                                                |
| 7.1                                                                                | Threat Analysis Methodology........................................................................ | 28                                                                                |
| 7.2                                                                                | Threats to Public Safety Mobile Devices....................................................... | 31                                                                                |
| 7.3                                                                                | Threats to Public Safety Wearable Devices..................................................

Security Analysis of First Responder Mobile and Wearable Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Personal Identity Verification (PIV) of Federal Employees and Contractors support CMMC certification?

[Assistant]
According to Personal Identity Verification (PIV) of Federal Employees and Contractors:

s  to  access  security-sensitive  buildings,  information  systems,  and  applications. An accurate  determination  of  an  individual's  identity  supports  making  sound  access  control decisions.
This  document  establishes  a  standard  for  a  Personal  Identity  Verification  (PIV)  system that  meets  the  control  and  security  objectives  of  Homeland  Security  Presidential Directive-12. It  is  based  on  secure  and  reliable  forms  of  identity  credentials  issued by  the  Federal  Government  to  its  employees  and  contractors. These  credentials  are used  by  mechanisms  that  authenticate  individuals  who  require  access  to  federally controlled  facilities,  information  systems,  and  applications. This  Standard  addresses requirements  for  initial  identity  proofing,  infrastructure  to  support  interoperability of  identity  credentials,  and  accreditation  of  organizations  and  processes  issuing  PIV credentials. Keywords: authentication,  authenticator,  biometrics,  credential,  cryptography,  derived PIV  credentials,  digital  identity,  Federal  Information  Processing  Standards  (FIPS), HSPD-12,  federation,  identification,  identity  proofing,  integrated  circuit  card,  Personal Identity  Verification,  PIV,  PIV  identity  account,  public  key  infrastructure,  verification

## Federal Information Processing Standards Publication 201-3 January  2022

## Announcing  the  Standard  for

## Personal  Identity  Verification  (PIV) of  Federal  Employees  and  Contractors

Federal  Information  Processing  Standards  Publications  (FIPS  PUBS)  are  issued  by  the National  Institute  of  Standards  and  Technology  (NIST)  after  approval  by  the  Secretary  of Commerce  pursuant  to  Section  5131  of  the  Information  Technology  Management  Reform Act  of  1996  (Public  Law  104-106)  and  the  Computer  Security  Act  of  1987  (Public  Law 100-235). 1. Name  of  Standard.

Personal Identity Verification (PIV) of Federal Employees and Contractors


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to NIST Cloud Computing Forensic Science Challenges:

1. Search authority. Legal authority is required to conduct a search and/or seizure of data. 2. Chain of custody. In legal contexts, chronological documentation of access and handling of evidentiary items is required to avoid allegations of evidence tampering or misconduct. 3. Imaging/hashing function. When items containing potential digital evidence are found, each should be carefully duplicated and then hashed to validate the integrity of the copy. 4. Validated  tools. When  possible,  tools  used  for  forensics  should  be  validated  to  ensure reliability and correctness. 5. Analysis. Forensic analysis is the execution of investigative and analytical techniques to examine, analyze, and interpret the evidentiary artifacts retrieved. - Architecture (e.g., diversity, complexity, provenance, multi-tenancy, data segregation). Architecture challenges in cloud forensics include:
- o Dealing with variability in cloud architectures between Providers
- o Tenant data compartmentalization and isolation during resource provisioning
- o Proliferation of systems, locations, and endpoints that can store data
- o Accurate and secure provenance for maintaining and preserving chain of custody
- Data collection (e.g., data integrity, data recovery, data location, imaging). Data collection challenges in cloud forensics include:
- o Locating forensic artifacts in large, distributed, and dynamic systems
- o Locating and collecting volatile data
- o Data collection from virtual machines
- o Data  integrity  in  a  multi-tenant  environment  where  data  is  shared  among  multiple computers in multiple locations and accessible by multiple parties
- o Inability to image all of the forensic artifacts in the cloud
- o Accessing the data of one tenant without breaching the confidentiality of other tenants
- o Recovery of deleted data in a shared and distributed virtual environment
- Analysis (e.g., correlation, reconstruction, time synchronization, logs, metadata, timelines).

NIST Cloud Computing Forensic Science Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Security Assessment?

[Assistant]
According to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services:

|                                                                                |
| AM-5: Resources (e.g., hardware, devices, data, time, personnel, and software) are prioritized based on their classification, criticality, and business value. | Determine required resources to support current regulations and standards requirements for the responsible use of PNT systems. Provide adequate staffing with the appropriate training such that PNT support is available in a timely manner (consistent with thresholds defined in the organization's business plan). Formalize PNT roles provide a process for transitioning staff members (with PNT expertise) to be replaced. The remaining staff members are provided with necessary resources and PNT training. Identify and prioritize PNT system components, processors, and functions based on their classification, criticality, and business value. Identify the types of information in the organization's possession, custody, or control for which security safeguards are needed (e.g., sensitive or protected information). Stakeholders are advised to use other functions within the CSF to inform identification procedures. For example, while testing business continuity procedures, use the findings of a lost PNT source to identify which aspects of the mission were impacted and to what degree, and reprioritize accordingly. When identifying resources and prioritizing trade-offs for PNT systems, holistically consider requirements, such as availability, continuity, data integrity, timeliness of anomaly detection, response, and recovery. | 3GPP TS22.071 4 DHS CISA 3 ISO/IEC/IEEE 15939:2017 6.3.2.3 NIST SP 800-37 3 NIST SP 800-53 Rev. 5 AC-20, RA-9 USG FRP Appendix B |

Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services